CVE-2013-0074

Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

78.89% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-05-25, used in ransomware campaigns

Published

2013-03-13

Updated

2026-08-14

Proof-of-concept exploits (4)

• TwoPt4Mhz/Hun73r0★ · 2016-12-22
• likekabin/CapTipper-original_https-capture0★ · 2018-07-17
• likescam/CapTipper-original_https-capture0★ · 2018-07-17
• omriher/CapTipper724★ · 2023-03-16

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/ms13_022_silverl…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/41702
• https://www.exploit-db.com/exploits/29858

Security advisories

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-022
• http://www.us-cert.gov/ncas/alerts/TA13-071A

References

• CVE Record
• NVD entry

Related

• CVE-2015-5477
• CVE-2016-2434
• CVE-2016-5342
• CVE-2016-8655
• CVE-2017-0199
• CVE-2017-0478